Citizens Insurance Company of America v. Mullins Food Products, Inc.

135 F.4th 1082

• Court: Court of Appeals for the Seventh Circuit
• Decided: May 2, 2025
• Docket: 24-1524
• Status: Published

Opinion

In the

United States Court of Appeals For the Seventh Circuit ____________________ No. 24-1524 CITIZENS INSURANCE COMPANY OF AMERICA, Plaintiff-Appellee,

v.

MULLINS FOOD PRODUCTS, INC., Defendant-Appellant. ____________________

Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 1:22-cv-01334 — Jorge L. Alonso, Judge. ____________________

ARGUED OCTOBER 28, 2024 — DECIDED MAY 2, 2025 ____________________

Before ROVNER, BRENNAN, and KOLAR, Circuit Judges. ROVNER, Circuit Judge. This is yet another of the many in- surance coverage disputes presenting the interplay between claims against an insured for violations of Illinois’ Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1, et seq., and various exclusions in the insured’s commercial liability insur- ance policy. The insured in this case, defendant-appellant Mullins Food Products, Inc. (“Mullins”) was sued in Illinois 2 No. 24-1524

state court for violating BIPA. Mullins tendered defense of the suit to its liability insurer, Citizens Insurance Company of America (“Citizens”), but Citizens declined to defend Mul- lins. Instead, Citizens filed this federal suit seeking a declara- tory judgment that it has no duty to defend or indemnify Mul- lins based on two different exclusions in the commercial lia- bility insurance policies Citizens issued to Mullins in 2015, 2016, and 2017. While this suit was pending, Mullins settled the state-court action. The district court ultimately agreed with Citizens that the policy exclusions for the Access Or Dis- closure Of Confidential Or Personal Information (the “Access or Disclosure” exclusion) and the Recording And Distribution Of Material Or Information In Violation Of Law (the “Statu- tory Violations Exclusion”) relieved Citizens of the duty to defend or indemnify Mullins. Citizens Ins. Co. of Am. v. Mullins Food Prods., Inc., 719 F. Supp. 3d 822 (N.D. Ill. 2024); R. 98. We vacate and remand for further proceedings. We con- clude that the Access or Disclosure Exclusion, found only in the 2016 and 2017 policies issued to Mullins, bars coverage for BIPA claims, but the Statutory Violation Exclusion, found in all three of the policies, does not. Assuming that Mullins com- plied with the duty to provide notice of the state-court action to Citizens “as soon as practicable”—a matter that remains to be decided on remand—Citizens will have been obliged to de- fend and indemnify Mullins in the state litigation pursuant to the 2015 policy and will be liable to reimburse Mullins for its fees and costs in defending that action. I. As relevant here, BIPA imposes restrictions on how a pri- vate employer may collect, retain, and disclose an individ- ual’s biometric identifiers, including fingerprints, retina or No. 24-1524 3

iris scans, voiceprints, and scans of hand or face geometry. Among other requirements, an employer must obtain a worker’s written consent to collection of his biometric identi- fiers, may not distribute such data without the employee’s consent, and must have a written plan regarding the retention and elimination of such data. 740 ILCS 14/15; see Citizens Ins. Co. of Am. v. Wynndalco Enters., LLC, 70 F.4th 987, 991–93 (7th Cir. 2023). Mullins is a food ingredient manufacturer with a plant in Broadview, Illinois, employing 503 individuals. In 2018, Mul- lins was acquired by Newly Wed Foods, Inc., an international firm which has some 25 to 30 plants worldwide; Newly Wed is headquartered in Chicago. Mullins scanned its employees’ fingerprints in order to help monitor and manage its workers’ time on the job. Mul- lins in turn allegedly disseminated electronic information de- rived from scanning its employees’ biometric identifiers to third-party vendors for timekeeping, data storage, and pay- roll purposes. In contravention of BIPA, Mullins allegedly did not formally inform its employees that it was collecting and disseminating their biometric identifiers, it did not obtain their written consent to do so, and it did not draft and publish a policy regarding how such biometric information would be collected, used, stored, or disseminated. In February 2021, Ricardo Galan, a former Mullins em- ployee, filed a putative class action against Mullins in the Cir- cuit Court of Cook County seeking damages for the com- pany’s BIPA violations. Not until January 2022 was Citizens, Mullins’ commercial liability insurer, given notice of a claim under the terms of the insurance policies in force during the relevant time period. 4 No. 24-1524

In March 2022, Citizens filed this action seeking a declara- tion that it has no duty to defend or indemnify Mullins against the Galan lawsuit. Mullins in turn filed an answer and counterclaim seeking a contrary declaration. Count II of Mul- lins’ counterclaim alleges that Citizens breached the insur- ance policies by not providing a defense for Mullins in the Ga- lan lawsuit and seeks an award of the costs and attorney’s fees it bore in defending the suit on its own. Mullins settled with the Galan plaintiffs in 2024, so its fees and costs presumably are now a fixed number. See Galan v. Mullins Food Prods., Inc., No. 2021-CH-00898, Order Granting Final Approval to Class Action Settlement and Final Judgment (Cir. Ct. Cook Cnty. Oct. 2, 2024), reproduced at https://mullinsbipasettle- ment.com/media/5062204/mlgl_order_granting_final_ap- proval_to_class_action_settlement_and_final_judgment.pdf [https://perma.cc/XQ9E-MDKF] (visited May 2, 2025). There are three Citizens insurance policies at issue in this case, each effective for a period of one year beginning on March 24; the first became effective on March 24, 2015, and the last expired on March 24, 2018. For the sake of simplicity, we will refer to these as the 2015, 2016, and 2017 policies. “Coverage B” in each of the three policies purported to give Mullins liability coverage for a “personal and advertising injury” (R. 1-1 at 167, 403, 686) which was expressly defined to include, among other things, “[o]ral or written publication, in any manner, of material that violates a person’s right of pri- vacy” (R. 1-1 at 175, 412, 695). 1 Thus, in the absence of an

1 Also covered as personal and advertising injuries are injuries arising

out of false arrest, detention, or imprisonment; malicious prosecution; wrongful eviction from a personal residence by or on behalf of a landlord; (continued) No. 24-1524 5

applicable exclusion, the policies would provide coverage for the injuries alleged in the Galan lawsuit, as BIPA violations are, essentially, privacy violations. West Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, ¶ 49. Citizens would therefore have a duty to defend Mullins in the Galan litigation. However, each of the three policies also includes one or more exclusions that, in Citizens’ view, foreclose coverage of the claims made in the Galan litigation and relieve it of the duty to provide Mullins with a defense. The Access or Disclosure Exclusion bars coverage for a personal and advertising injury arising out of any access to or disclosure of any person’s or organization’s confidential or per- sonal information, including patents, trade se- crets, processing methods, customer lists, finan- cial information, credit card information, health information or any other type of nonpublic in- formation. R. 1-1 at 421, 712. Again, the Access or Disclosure Exclusion was included (by endorsement) only in the 2016 and 2017 po- lices; it was not included in the 2015 policy.

oral or written publication of material that slanders or libels a person or organization or disparages a person’s or organization’s goods, products, or services; use of another’s advertising idea in an advertisement; and in- fringing upon another’s copyright, trade dress, or slogan in an advertise- ment. R. 1-1 at 175, 412, 695. 6 No. 24-1524

As noted, the Statutory Violations Exclusion was included in all three policies. This is a somewhat more complex exclu- sion; it excludes coverage for: “Personal and advertising injury” arising di- rectly or indirectly out of any action or omission that violates or is alleged to violate:

(1) The Telephone Consumer Protection Act (TCPA), including any amendment of or addi- tion to such law;

(2) The CAN-SPAM Act of 2003, including any amendment of or addition to such law;

(3) The Fair Credit Reporting Act (FCRA), and any amendment of or addition to such law, in- cluding the Fair and Accurate Credit Transac- tions Act (FACTA); or

(4) Any federal, state or local statute, ordinance or regulation, other than the TCPA, CAN- SPAM Act of 2003 or FCRA and their amend- ments and additions, that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or in- formation. R. 1-1 at 178, 404, 687. Citizens reads this exclusion to unam- biguously exclude coverage for the BIPA claims asserted in Galan, in that such claims involve the collecting, recording, and dissemination of a person’s biometric “information.” Our decision in Wynndalco, however, found a version of this exclusion similar (though not identical) to the one No. 24-1524 7

presented in this case not to foreclose the insurer’s duty to de- fend its insured against a BIPA claim. 2 We acknowledged that although it was possible to read the catchall language in iso- lation to include BIPA claims, as well as a wide range of other statutory claims, such a reading would also nullify or “swal- low” a substantial portion of the coverage that the policy pur- ported to provide for personal and advertising injuries. 70 F.4th at 997–98. It was not possible to avoid that problem by construing the exclusion to reach only statutory causes of ac- tion relating to privacy: There was no hint of privacy any- where in the language of the exclusion, and to narrow the ex- clusion in this way would presume that the exclusion’s other- wise sweeping language meant something other than what it said. Id. at 998–99. For that reason, we treated the catchall ex- clusion as ambiguous. Id. at 999. Resort to the doctrines of ejusdem generis and noscitur a sociis did not resolve the ambi- guity, as there was no readily discernible theme among the three statutes cited immediately prior to the catchall—includ- ing Citizens’ posited theme of privacy—that would suggest

2 There are two differences between the exclusion at issue in Wynndalco and the one presented in this case. First, the catchall provision of the Wynndalco exclusion lacked the “other than” clause referencing the statutes cited by name immediately prior to the catchall provision; in Wynndalco, the catchall simply referenced “[a]ny other laws, statutes, ordi- nances, or regulations, that address, prohibit or limit the printing, dissem- ination, disposal, collecting, recording, sending, transmitting, communi- cating or distribution of material or information.” 70 F.4th at 993 (empha- sis added). Second, whereas the heading of the exclusion in this case refers to the “Recording and Distribution of Material or Information in Violation of Law,” the exclusion in Wynndalco referred more generically and broadly to the “Distribution of Material in Violation of Statutes.” See id. Apart from those differences, the two catchall provisions are materially identical. 8 No. 24-1524

how the scope of the broad catchall provision could be con- strued in a way that was consistent with the terms of the over- all exclusion and yet did not eliminate a broad swath of the coverage that the policy otherwise ostensibly provided for personal and advertising injuries. Id. at 1000–04. We therefore construed the provision in the insured’s favor and held that Citizens had a duty to defend the insured. Id. at 1004–05. Initially, the district court in this case rejected Citizens’ contention on summary judgment that the Access or Disclo- sure Exclusion and the Statutory Violations Exclusion re- lieved it of the duty to defend Mullins. Citizens Ins. Co. of Am. v. Mullins Food Prods., Inc., 684 F. Supp. 3d 762 (N.D. Ill. 2023); R. 61. The court deemed our Wynndalco decision to “directly control[ ]” as to the Statutory Violations Exclusion and found that exclusion to be ambiguous. R. 61 at 15. The court likewise found the Access or Disclosure Exclusion (which was not ad- dressed in Wynndalco) to be ambiguous. R. 16 at 16–22. As to the question of whether Mullins had provided timely notice of the Galan lawsuit to Citizens, the court concluded that there were disputes of material fact that precluded summary judg- ment. R. 16 at 26–28. Resolution of Citizens’ duty to defend Mullin in the Galan litigation would thus have to wait until a trial could be conducted on the notice issue. However, the court did enter summary judgment against Mullins on its counterclaim for breach of contract, reasoning that Citizens’ timely commencement of this declaratory judgment action precluded a finding that Citizens had breached its duty to de- fend Mullins even if the court were ultimately to conclude that Citizens owed Mullins a defense in the Galan suit. R. 61 at 29–31. No. 24-1524 9

However, based on the Illinois Appellate Court’s interven- ing decision in Nat’l Fire Ins. Co. of Hartford v. Visual Pak Co., 2023 IL App (1st) 221160, app. denied, 238 N.E.3d 303 (Ill. 2024), the district court subsequently reconsidered its decision and granted summary judgment to Citizens, concluding that both the Statutory Violations Exclusion and the Access or Disclo- sure Exclusion barred coverage for BIPA claims and thus re- lieved Citizens of the obligation to defend Mullins. R. 98. In Visual Pak, the Illinois Appellate Court disagreed with our application of the “swallowing” principle in Wynndalco. That principle only applies, the court said, when an exclusion truly eliminates all of the coverage provided elsewhere in the policy. Id. ¶¶ 84, 96. Thus, if one reads the catchall provision literally and broadly to include violations of statutory privacy protections, the result would be to bar coverage for BIPA claims, yes, but it would still leave coverage in place for com- mon law violations arising from an invasion of one’s privacy. Id. ¶¶ 99–100; see also Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1249 (7th Cir. 2021) (Hamilton, J., concurring) (noting that injuries in cases alleging BIPA violations “would be com- parable to injuries in invasion-of-privacy and unjust enrich- ment that the law has long recognized”). The same could be said for other types of personal and advertising injuries for which the policy provided coverage: statutory violations might be excluded from coverage by dint of a plain-text read- ing of the catchall, but violations of common law rights would remain covered. 2023 Ill. App. (1st) 221160 ¶¶ 104–05. Thus, a broad reading of the exclusion would not “swallow” the cov- erage provided for in the personal and advertising injury pro- vision, and thus did not render the policy ambiguous. And although the court appeared to acknowledge that Wynndalco might possibly be right in positing that some forms of 10 No. 24-1524

personal and advertising injuries, like copyright violations, could only be redressable through statutory causes of actions (with no common law counterparts)—the court observed that those types of injuries were not related to privacy and were not at issue in the case before it and as such did not need to be considered. Id. ¶¶ 112–121. Visual Pak went on to reason that there was also a more focused understanding of the catchall that would nonetheless bar coverage for BIPA claims. The insurer in Visual Pak, like the insurer in Wynndalco, argued that the common thread among the three statutes cited by name immediately preced- ing the catchall is privacy, such that the catchall itself should be construed to reach only injuries arising out of statutory pri- vacy violations. We, of course, had rejected that argument in Wynndalco, whether as a plausible narrowing construction of the Statutory Violations Exclusion in order to avoid an ambi- guity or as an application of ejusdem generis to resolve such ambiguity. 70 F.4th at 998–99, 1002–04. We noted, inter alia, that reading a policy gloss into the exclusion required a fairly nuanced analysis and understanding of the various statutes cited by name in the exclusion that would be beyond the com- prehension of the ordinary commercial insured. Id. at 1003– 04. Not so, said the court in Visual Pak. “[W]e [do not] deem it especially sophisticated for an insured purchasing this busi- ness liability insurance to understand that these groups of statutes touch on various aspects of an individual's personal privacy, though not precisely in the same way.” 2023 Ill. App. (1st) 221160 ¶ 70. The Visual Pak court went on to note that the heading of the exclusion there referred specifically to the “Re- cording and Distribution of Material or Information in Viola- tion of Law” (emphasis added) rather than simply to the “Dis- tribution of Material in Violation of Statutes” as was the case No. 24-1524 11

in Wynndalco. Id. ¶ 71. “That is no small difference” in terms of signaling that the exclusion was focused on privacy. ¶ 72. The court added that some terms in the catchall provision of the exclusion—including in particular the “disposal, collect- ing, and recording” of material or information—“only make sense in the context of the secrecy element of privacy.” Id. ¶ 73. Thus, in view of what the court found to be the shared thread of privacy among the three statutes cited by name in the exclusion, the heading of the exclusion, and the terms used in the catchall provision of the exclusion, it was “not un- reasonable at all” to construe the catchall to reach privacy-re- lated statutes like BIPA. Id. ¶ 73. Following Visual Pak’s lead, the district court on reconsid- eration concluded that the catchall provision of the Statutory Violations Exclusion should be understood to exclude cover- age for injuries arising from BIPA violations. First, the court noted that our own decision in Wynndalco and the state court’s decision in Visual Pak agreed that a literal, plain-text reading of the catchall provision would reach BIPA violations. R. 98 at 17. Second, as in Visual Pak, the heading of the exclusion in this case—“Recording And Distribution Of Material Or Infor- mation In Violation Of Law”—is worded in such a way as to suggest that the exclusion overall is aimed at privacy-related violations. R. 98 at 17. Third, reading the exclusion, including the catchall, as being privacy-focused obviates the need to re- sort to ejusdem generis or other interpretive canons. R. 98 at 18. Fourth, by limiting the exclusion to violations of the named statutes and other privacy-related violations, one avoids the potential “swallowing” problem that we referenced in Wynndalco. R. 98 at 18–20. 12 No. 24-1524

The court relied on Visual Pak to further conclude that the Access or Disclosure Exclusion likewise bars coverage for in- juries arising from BIPA violations. Looking a second time at the Access or Disclosure Exclusion in light of Visual Pak, the court concluded that this exclusion unambiguously excludes coverage for gathering or disclosing an individual’s biometric identifiers or information. The exclusion reaches injuries aris- ing from “any access to or disclosure of any person’s … con- fidential or personal information … .” The policies do not de- fine “personal information,” but “it takes no stretch of the im- agination to find that it would include information typically kept private.” R. 98 at 22. Although the subsequent list of ex- amples in the policy omits mention of fingerprints or other biometric information, such information, like one’s financial and health information, is another aspect of one’s private data and information. R. 98 at 23. Finally, reading the Access or Disclosure Exclusion to reach injuries resulting from BIPA vi- olations would again not present the “swallowing” problem with which we were concerned in Wynndalco. R. 98 at 28. Having now concluded that both of the two foregoing ex- clusions reached BIPA claims, the district court found that Citizens had no duty to defend or indemnify Mullins in the Galan litigation. The court vacated its prior ruling on the ques- tion of whether Mullins had given Citizens timely notice of the Galan suit (which found that disputes of material fact pre- cluded summary judgment), given that its new ruling as to the exclusions rendered the notice question moot. R. 98 at 28. The court declined to reconsider its prior ruling against Mul- lins on its counterclaim for breach of contract. R. 98 at 28–29. After the district court’s reconsideration decision in favor of Citizens, this court in Thermoflex Waukegan, LLC v. Mitsui No. 24-1524 13

Sumitomo Ins. USA, Inc., 102 F.4th 438, 440–41 (7th Cir. 2024), held that an Access or Disclosure Exclusion identical to the one in the Citizens policy unambiguously excluded coverage for BIPA claims. However, the court also found that an exclu- sion quite similar to the Statutory Violations Exclusion at is- sue in Visual Pak and in this case did not apply to BIPA claims. Id. at 442. In reaching that conclusion, the court set aside the Illinois Appellate Court’s Visual Pak decision and this court’s Wynndalco decision and instead relied on the Illinois Supreme Court’s decision in West Bend Mut. Ins. Co. v. Krishna Schaum- burg Tan, Inc., 2021 IL 125978, to conclude that the Statutory Violations Exclusion did not unambiguously exclude cover- age for BIPA claims. Thermoflex, 102 F.4th at 441–42. Mullins now appeals. It argues first and principally that we should certify to the Illinois Supreme Court the question of whether the two policy exclusions at issue in this case ex- clude coverage for BIPA claims, given the conflicting deci- sions among federal and state courts as to the proper under- standing of these exclusions. Alternatively, Mullins urges that we follow Wynndalco and Thermoflex to find the Statutory Vi- olations Exclusion here to be ambiguous. As to the Access or Disclosure Exclusion, Mullins acknowledges that Thermoflex finds this provision to unambiguously exclude coverage for BIPA claims, but Mullins criticizes the logic of that decision and suggests that we overrule Thermoflex in that respect. For its part, Citizens urges that we follow Thermoflex and hold that the Access or Disclosure Exclusion is clear and ex- cludes coverage for BIPA claims. As to the Statutory Viola- tions Exclusion, however, Citizens urges us to follow the Illi- nois Appellate Court’s decision in Visual Pak and to overrule both Wynndalco and Thermoflex to find that this exclusion also 14 No. 24-1524

unambiguously bars coverage for BIPA claims. Alternatively, Citizens asks that we affirm on an independent ground that the district court did not reach, which is the timeliness of Mul- lins’ notification of the Galan suit. II. As we explain below, our recent decision in Thermoflex re- solves the parties’ dispute as to the clarity of the two exclu- sions at issue in this case: the Access or Disclosure Exclusion unambiguously excludes coverage for BIPA claims, whereas the Statutory Violations Exclusion does not. We see no need to extend the litigation further by certify- ing the proper understanding of either exclusion to the Illinois Supreme Court. The Access or Disclosure Exclusion is clear on its face, and we are confident that the Illinois Supreme Court would find, as we have, that it excludes coverage for BIPA claims. As for the Statutory Violations Exclusion, this court in Thermoflex (with the benefit of the Illinois Appellate Court’s decision in Visual Pak) followed the Illinois Supreme Court’s own example in Krishna of construing this exclusion and finding it not to unambiguously exclude coverage for in- juries resulting from BIPA violations. We have no reason to think that the Illinois Supreme Court would depart from the approach it took in Krishna. Consequently, Citizens has no duty to defend or indem- nify Mullins under the 2016 and 2017 policies, each of which contains the Access or Disclosure Provision; it does, however, have a duty to defend and indemnify Mullins under the 2015 policy, which lacks the Access or Disclosure Provision and has only the Statutory Violations Exclusion, which we have held not to exclude coverage for BIPA claims. No. 24-1524 15

This assumes, of course, that Mullins gave timely notice to Citizens of the Galan litigation. The district court has not yet reached that question—having vacated its prior ruling on the notice issue—and so we will remand in order to allow it to do so. Finally, the district court incorrectly granted summary judgment to Citizens on Mullins’ counterclaim seeking con- tractual damages for Citizens’ failure to supply Mullins with a defense in the Galan litigation to date. That Citizens had a right to file this declaratory action to seek a decision on its duty to defend does not relieve Citizens of the obligation to reimburse its insured in the event the court determines that Citizens owed Mullins a defense and that Mullins gave Citi- zens timely notice of the Galan suit. A. The Access or Disclosure Exclusion This is the more straightforward of the two policy exclu- sions at issue in this case. Again, the exclusion bars coverage for any claim “arising out of any access to or disclosure of any person’s or organization’s confidential or personal infor- mation,” and the list of information qualifying as confidential or personal includes “patents, trade secrets, processing meth- ods, customer lists, financial information, credit card infor- mation, health information or any other type of nonpublic infor- mation.” (Emphasis ours.) This court’s opinion in Thermoflex finds this exclusion to unambiguously exclude coverage for BIPA claims, affirming then-District Judge Lee’s decision be- low on this point. As we noted in Thermoflex, Judge Lee reasoned that “the ordinary understanding of ‘confidential or personal infor- mation’ includes handprints and other biometric identifiers 16 No. 24-1524

usable for identity theft.” 102 F.4th at 440. (BIPA itself, Judge Lee noted, describes biometric identifiers as confidential, i.e. nonpublic, information. See 102 F.4th at 440.) We endorsed that conclusion and went on to reject the insured’s argument that because patents are expressly identified as one of the types of information covered by the exclusion, and patents are public, the clause was ambiguous. True, the list contains mismatched items. But how does this create ambiguity about either the opening phrase (“any person’s or organiza- tion’s confidential or personal information”) or the catchall “any other type of nonpublic infor- mation”)? Sticking one blue item into a list that begins “all red items including …” and closes “plus anything pink” does not nullify the lan- guage’s application to ruby-colored things. Id. at 441 (citation omitted). Finally, although the insured in Thermoflex pointed to this court’s decision in Wynndalco and contended that a broad reading of the exclusion threatened to nullify or “swallow” coverage that the insurance policy purported elsewhere to provide, we rejected that argument. We acknowledged that the Illinois Appellate Court’s decision in Visual Pak found that Wynndalco misapprehended Illinois law on this point. Id. at 441. But we saw no need to “try to predict whether the Su- preme Court of Illinois is more likely to follow Visual Pak than to follow Wynndalco. It is enough that the exclusion in this pol- icy does not have the flaw that led to the decision in Wynndalco. It leaves plenty of room for coverage of the main insured hazards.” Id. No. 24-1524 17

Thermoflex leaves no doubt that the Access or Disclosure Exclusion bars coverage for BIPA claims. Mullins criticizes the decision and argues that it is inconsistent with the inter- pretive approach we took in Wynndalco, but it is enough to say here that Wynndalco did not address the Access or Disclosure Exclusion—it was not presented in that case. This exclusion is straightforward and explicit, and the or- dinary understanding of an individual’s “confidential or per- sonal information” plainly includes their biometric identifi- ers. Thermoflex, 102 F.4th at 440–41. As there can be no reason- able doubt that the exclusion excludes coverage for BIPA claims, Citizens does not owe Mullins a duty of defense or indemnification in the Galan litigation under the 2016 and 2017 policies. B. The Statutory Violations Exclusion A question remains as to whether Citizens owes Mullins a duty of defense under the 2015 policy, which does not include the Access or Disclosure Exclusion. The 2015 policy does in- clude the Statutory Violations Exclusion, which the district court ultimately found to bar coverage for BIPA claims and relieve Citizens of a duty to defend. What makes this provision more challenging to construe is that it lists several statutory violations that are expressly ex- cluded by name from coverage (violations of the Telephone Consumer Protection Act, CAN-SPAM Act, and the Fair Credit Reporting Act) but then concludes with a broad catchall that purports to exclude coverage for violations of “[a]ny federal, state or local statute, ordinance or regulation, other than the [three federal statutes listed previously] that addresses, prohibits, or limits the printing, dissemination, 18 No. 24-1524

disposal, collecting, recording, sending, transmitting, com- municating or distribution of material or information.” Wynndalco, as we have noted, found the catchall to be am- biguous in large part because a plain-text reading of the ex- clusion in isolation would purport to exclude or “swallow” coverage for a large swath of statutory claims—including, but not limited to, BIPA privacy claims (see n.1, supra) —that Cov- erage B of the policy would lead an insured to believe were covered by the policy as claims for personal and advertising injuries. The Illinois Appellate Court’s decision in Visual Pak, of course, disagreed with our application of the “swallowing” principle, emphasizing that even a broad understanding of the exclusion’s catchall provision for statutory violations would leave a number of corresponding common-law claims for personal and advertising injuries—including defamation, commercial disparagement, and as relevant here, invasion of privacy—covered by the policy. 2023 IL App (1st) 221160, ¶¶ 99–102, 105. But the court also placed a privacy gloss on the exclusion that significantly narrowed the scope of the catchall provision and obviated the swallowing concern. Id. ¶¶ 57–78. This court in Thermoflex had the full benefit of the Illinois court’s decision in Visual Pak as well as our prior decision in Wynndalco, put both decisions aside, turned to the Illinois Su- preme Court’s decision in Krishna, and concluded that the catchall provision of the Statutory Violations Exclusion did not unambiguously exclude coverage for BIPA violations. Krishna focused on the statutes expressly mentioned in the ex- clusion just prior to the final catchall provision—there, the Telephone Consumer Protection Act (which regulates No. 24-1524 19

telephone calls and faxes) and the CAN-SPAM Act (which regulates emails)—and observed that “regulating telephone calls, faxes, and emails is fundamentally different from regu- lating the collection, use, storage, and retention of biometric identifiers and information … .” 2021 IL 125978, ¶ 55. 3 Apply- ing the ejusdem generis canon to determine what the catchall language meant by statutes “other than” the TCPA and CAN- SPAM Act, the court “construe[d] the ‘other than’ language to mean other statutes of the same general kind that regulate methods of communication like the TCPA and the CAN- SPAM Act.” Id., ¶ 58. BIPA was not such a statute. Id. Taking our cue from Krishna, our Thermoflex decision looked to the statutes cited immediately in advance of the catchall provision to determine what types of statutory provi- sions the latter provision was meant to reach. We noted that the exclusion began with the same two statutes cited by name in Krishna and added a third: the Fair Credit Reporting Act. 102 F.4th at 442. 4 One need not get beyond the name of that stat- ute to see how different it is from BIPA. In this diversity suit, we are bound by the way the Su- preme Court of Illinois has treated language structured like the Statutory Violation

3 The heading of the exclusion at issue in Krishna read, “Violation of

Statutes That Govern E-Mails, Fax, Phone Calls or Other Methods of Send- ing Material or Information.” 2021 IL 125978, ¶ 58. 4 The exclusion at issue in Thermoflex was unaccompanied by a head-

ing. See Thermoflex Waukegan, LLC v. Mitsui Sumitomo Ins. USA, Inc., No. 21 C 788, 2023 WL 319235, at *6 (N.D. Ill. Jan. 19, 2023). 20 No. 24-1524

Exclusion, so we agree with the district court that this exclusion … does not apply to BIPA. Id. Thermoflex leaves no doubt as to how we should read the catchall provision here. For a proper understanding of the scope of the catchall, we look to the three statutes expressly identified immediately preceding (and cited in the “other than” clause of) the catchall for guidance as to what other types of statutory violations are subsumed within the catchall. Krishna noted that the two statutes named in that case—the TCPA and the CAN-SPAM Act—were unlike BIPA in that they regulated communications. Here as in Thermoflex, there is an added third statute—the FCRA—which deals with how individual’s credit history is reported to third parties and, as we noted in Thermoflex, is also patently different in kind from BIPA. Viewed through the lens of Krishna, the catchall provision does not include BIPA violations. 5

5 Whereas the exclusion at issue in Thermoflex had no heading, the ex-

clusion here is titled, “Recording And Distribution Of Material Or Infor- mation In Violation Of Law.” That distinction does not counsel in favor of a different result. A heading can inform the understanding of the text that follows, but it cannot broaden the reach of the exclusion. See Wynndalco, 70 F.4th at 1002 n.10. Visual Pak found the wording of an identical heading significant, because one of the multiple meanings of the term “recording” includes the “inscribing on a tangible medium or sorting in an electronic or other medium in such a way as to make it retrievable in perceivable form.” 2023 IL App (1st) 221160, ¶ 61. As Visual Pak saw things, this mean- ing of the term “recording” was a strong indicator that the exclusion was focused on privacy, because it was suggestive of the collection of biometric identifiers and information. But the terms “recording” and “distribution” both have many meanings and potentially could apply to a broad range (continued) No. 24-1524 21

The Statutory Violations Exclusion therefore does not re- lieve Citizens of the duty to defend and indemnify Mullins in the Galan litigation. Assuming that Mullins gave Citizens timely notice of the litigation (a point we address below), then Citizens owed Mullins a defense in the Galan suit and must also indemnify Mullins insofar as the suit implicates the 2015 policy. 6

of information and material, including, for example, the recording and disseminating (via radio or internet) of a copyrighted piece of music; mak- ing a digital scan of the drawings and specifications for a patented ma- chine and emailing them to a competitor of the patent holder; download- ing the results of an individual’s DNA profile and selling it to medical researchers; printing a driver’s tollway history and sharing it with law en- forcement; assembling a consumer’s credit history and transmitting it to retailers and employers; and so on. Here, what gives us the best indication of what types of “recording” and “distribution” the catchall provision was meant to capture are the three statutes identified immediately prior to the catchall, and those statutes, as Thermoflex recognized, are very different from BIPA. 6 For purposes of the settlement with Mullins, the class period was

defined to commence on February 24, 2016, several weeks prior to the end of the 2015 policy coverage period. See Galan v. Mullins Food Prods., Inc., No. 2021-CH-00898, Order Preliminarily Approving Class Action Settle- ment and Certifying the Settlement Class, at 3 (Cir. Ct. Cook Cnty. Jul. 5, 2024), reproduced at https://mullinsbipasettlement.com/media/4878149/ mlgl_order_preliminarily_approving_class_action_settlement_and_certi- fying_the_settlement_class.pdf [https://perma.cc/87G3-4STM] (visited May 2, 2025). The parties do not address the import, if any, of the fact that only one of the three policy periods overlaps with the Galan lawsuit. That is a matter that can be addressed on remand in the event the district court ultimately concludes that Citizens has a duty to defend and indemnify Mullins. 22 No. 24-1524

C. Breach of the duty to defend As we have noted, when Mullins answered Citizens’ de- claratory judgment complaint, it also filed a counterclaim, Count I of which seeks a declaratory judgment that Citizens owed Mullins a defense in the Galan litigation, and Count II of which alleges that Citizens breached its contractual obliga- tion to provide Mullins with that defense. Pursuant to its breach-of-contract claim, Mullins sought reimbursement for the attorney fees and other defense costs it had incurred in the Galan litigation to date. In granting Citizens’ motion for sum- mary judgment on this claim, the district court relied on a line of Illinois cases holding that an insurer may decline to defend the insured and still preserve its contractual defenses by seek- ing declaratory relief, as well as an Illinois appellate prece- dent holding that when an insurer files a declaratory judg- ment action challenging its duty to defend its insured, the in- surer’s duty of defense is suspended. See Those Certain Under- writers at Lloyd’s v. Prof’l Underwriters Agency, Inc., 848 N.E.2d 597, 601 (Ill. App. Ct. 2006). That suspension, in the district court’s view, relieved the insurer of its duty to defend until such time as the court concluded that the insurance contract obligated the insurer to provide a defense to its insured. Con- sequently, there could be no breach of the duty to defend dur- ing the period of suspension that would support an award of damages compensating the insured for its defense costs dur- ing that period. “A finding that Citizens breached its duty to defend by contesting coverage and promptly seeking a decla- ration of no duty to defend would, without more, render No. 24-1524 23

illusory the declaratory judgment option that Illinois courts have long upheld.” R. 61 at 30–31. As we shall see, the parties’ dispute on this point is less about the fact of Citizens’ prospective liability to Mullins than about how to characterize that liability. Citizens’ position, which the district court adopted, is that it cannot be said to have breached an obligation to defend Mullins given that it filed this declaratory action. Mullins, on the other hand, ar- gues that if the district court ultimately concludes that Citi- zens had a duty to defend it, then Citizens necessarily will have breached that duty by not providing that defense (in the form of a lawyer or payment for one) in the three-plus years since Mullins notified Citizens of the Galan suit. Citizens does not contest that, if the court finds a duty to defend, it must reimburse Mullins for its defense costs. Its quarrel is with the label “breach of the duty to defend” and the baggage that carries as a matter of Illinois insurance law: breach of the duty to defend is typically identified as a basis for estopping the insurer from raising contractual defenses to policy coverage. Because Citizens timely sought declaratory relief as to its duty to defend, it cannot be estopped from as- serting such defenses. Yet, as Citizens concedes, filing this suit does not shield Citizens from responsibility for Mullins’ de- fense costs if the court ultimately rules in Mullins’ favor. Where Illinois law is unclear is on what legal theory the obli- gation to compensate Mullins can be made part of a judgment in its favor. As we conclude below, because Citizens concedes that if it owed Mullins a duty of defense it must reimburse Mullins for its defense costs, we need not resolve that issue definitively. In the event the district court resolves this action in Mullins’ favor, the district court must provide Mullins with 24 No. 24-1524

an appropriate remedy as to its defense costs, if only as an aspect of the declaratory relief it awards to Mullins. 7 As a matter of Illinois law, by timely filing a declaratory judgment action as to coverage, an insurer avoids the pro- spect of being estopped from raising coverage defenses. Santa’s Best Craft, LLC v. St. Paul Fire & Marine Ins. Co., 611 F.3d 339, 349–50 (7th Cir. 2010) (applying Illinois law); State Farm Fire & Cas. Co. v. Martin, 710 N.E.2d 1228, 1232 (Ill. 1999). Illinois was among the first of a minority of state jurisdictions to adopt an estoppel rule in the context of the duty to defend. See Stanley C. Nardoni, Estoppel for Insurers Who Breach Their Duty to Defend: Answering the Critics, 50 J. MARSHALL L. REV. 53, 56–64, 70–77 (2016). Generally, where a suit against the in- sured alleges facts that are potentially within the coverage of the insurance policy, and when the insurer takes the position that the policy does not cover the claim, the insurer must fol- low one of two courses in order to fully preserve its rights: (1) defend the suit under a reservation of rights, or (2) seek a declaratory judgment that there is no duty to defend. Std. Mut. Ins. Co. v. Lay, 2013 IL 114617, ¶ 19. The estoppel rule applies when the insured notifies its insurer of a claim against it and the insurer, believing it has no duty to defend, takes neither of these two avenues; instead, it does nothing, leaving the insured to its own devices. In that scenario, if it is later determined that the insurer wrongfully denied its insured a defense, then the insurer will be estopped from raising any policy defenses. E.g., Emp’rs Ins. of Wausau v. Ehlco Liquidating

7 We understand Mullins’ breach-of-contract claim to be seeking only

compensation for its defense costs in the Galan litigation and no other re- lief. Our analysis is therefore limited to the request for reimbursement of Mullins’ defense costs, including its attorney fees, in the Galan action. No. 24-1524 25

Trust, 708 N.E.2d 1122, 1134–35 (Ill. 1999). Thus, even if it turns out that the underlying claim against the insured falls outside the coverage provided by the policy, the insurer will nonetheless be deemed liable to pay the claim. See Thornton v. Paul, 384 N.E.2d 335, 340 (Ill. 1978), overruled in part on other grounds by Am. Fam. Mut. Ins. Co. v. Savickas, 739 N.E.2d 445, 449–51 (Ill. 2000); Martin, 710 N.E.2d at 1231–32. The rationale for estoppel is that where the insurer has, without justifica- tion, refused to defend its insured against a suit that plausibly falls within the coverage of the policy and taken no steps to independently confirm that it is not contractually required to defend the insured, it has effectively repudiated the policy and therefore should not be heard later to claim that the pol- icy terms do not provide coverage. “[T]he insurer has no right to insist that the insured be bound by the provisions of the insurance contract inuring to its benefit, i.e., the ‘Exclusions’ provisions, when it has already breached the contract by vio- lating the provisions inuring to the benefit of the insured, i.e., the defense provisions. In this sense it may properly be said to be estopped.” Sims v. Ill. Nat’l Cas. Co., 193 N.E.2d 123, 129 (Ill. App. Ct. 1963); see also Clemmons v. Travelers Ins. Co., 430 N.E.2d 1104, 1109 (Ill. 1981) (“The court will not enforce the insurer’s protections under the policy where the insurer has failed to act equitably, that is, failed to defend under a reser- vation of rights or to bring a declaratory judgment action to determine whether there was coverage under the policy.”) (ci- tations omitted); Edward T. Joyce & Assocs., P.C. v. Prof’ls Direct Ins. Co., 816 F.3d 928, 932 (7th Cir. 2016) (“Under Illinois law, ‘an insurer’s duty to defend under a liability insurance policy is so fundamental an obligation that a breach of that duty con- stitutes a repudiation of the contract.’”) (quoting Ehlco, 708 26 No. 24-1524

N.E.2d at 1135); Ehlco, 708 N.E.2d at 1136 (“The insurer cannot simply abandon its insured.”). Citizens did not repudiate its agreement with Mullins but rather sought prompt judicial resolution of its contention that the Galan suit was clearly excluded from coverage under the policy and that it thus had no duty to defend Mullins. See Waste Mgmt., Inc. v. Int’l Surplus Lines Ins. Co., 579 N.E.2d 322, 334 (Ill. 1991). In the ideal course of events, the declaratory judgment action would resolve the insurer’s duty to defend before the underlying claim proceeds to litigation, so that if the insured is owed a defense under the insurance policy, it is given one. See id. at 334 (“It is the purpose of the declaratory judgment action to settle actual controversies before they have ripened into violations of law or legal duty or breach of contractual obligations. The parties involved in the contro- versy can then learn the consequences of their action before they act.“) (citations omitted). But events do not always play out as the parties might wish. Not infrequently, the underly- ing claim against the insured may proceed to litigation, even judgment, before the declaratory judgment action finally re- solves the duty to defend. In that eventuality, the insured will have been left to defend the underlying action entirely on its own, as Mullins was here, before the parties learn whether the insured was owed a defense. Even in that scenario, however, so long as the insurer timely filed suit for declaratory judg- ment, the insurer will still enjoy the benefit of a safe harbor from estoppel, as the Illinois Supreme Court held in Martin, 710 N.E.2d at 1232. The Illinois Appellate Court’s decision in Those Certain Underwriters in turn construes Martin to mean that once the insurance company has filed a declaratory judg- ment action, its duty to represent the insured is “suspended” No. 24-1524 27

unless and until the court determines that the insurer is obli- gated to defend the insured. 848 N.E.2d at 601, 604. The district court here understood Those Certain Under- writers to signal that an insurer’s decision to seek declaratory relief precludes a subsequent finding that the insurer breached its duty to defend by leaving the insured to defend itself in the meantime without help from the insurer, even if the district court later concludes that the insurance contract in fact obligated the insurer to defend the insured. R. 61 at 30– 31. We are not so sure. Those Certain Underwriters itself recog- nizes that an insurer will be liable to the insured for its de- fense costs in the event the declaratory judgment action cul- minates in a finding that the insurer is bound to defend the insured: As defendants note in their reply brief, once a court has ruled that an insurer breached its duty to defend, the insurer will be liable to its insured for defense costs. General Star Indemnity Co. [v. Lake Bluff Sch. Dist. No. 65, 819 N.E.2d 784, 794 (Ill. App. Ct. 2004)]. Thus, should the insurer ul- timately fail in its declaratory judgment action … it may be liable for the cost of the defense it should have provided during the period of suspen- sion. … 848 N.E.2d at 603 (emphasis ours). 8

8 Those Certain Underwriters was a rescission case: the insurer alleged

that the insured had made fraudulent misrepresentations in its application for insurance and sought a declaration that it had no duty to defend the (continued) 28 No. 24-1524

The court’s citation to General Star Indemnity reinforces the point. General Star Indemnity reviewed a trial court’s declara- tory judgment that an insurance company was obliged to de- fend its insured (a school district) on two of three claims as- serted against the insured in a federal disability rights law- suit. The appellate court affirmed the lower court as to those two claims but reversed the trial court as to the third claim, concluding that the policy in question entitled the insured to a defense on that claim as well. It proceeded to award the in- sured the costs and fees it had incurred in defending that third claim, reasoning that the insured was entitled to recovery of those expenses for the insurer’s breach of contract. Gen. Star Indem., 819 N.E.2d at 794. See also Nat’l Cas. Co. v. S. Shore Iron Works, Inc., 341 F. Supp. 3d 884, 893 (N.D. Ill. 2018) (finding that insurer breached its duty to defend insured by rejecting the insured’s tender of claim notwithstanding insurer’s deci- sion to file declaratory judgment action), app. dismissed, 2018 WL 8053818 (7th Cir. Dec. 13, 2018); Am. Alt. Ins. Corp. v. Metro Paramedic Servs., Inc., 75 F. Supp. 3d 833, 847 (N.D. Ill. 2014) (same), j. aff’d, 829 F.3d 509 (7th Cir. 2016). Thus, even taking at face value Those Certain Underwriters’ language about an insurer’s duty to defend being suspended until the declaratory judgment has been resolved, 9 that

insured on that basis. Although the case was distinct in this sense from the run-of-the mill duty to defend case, Those Certain Underwriters applied tra- ditional duty-to-defend cases and in turn has been cited as authoritative in such cases. 9 This aspect of Those Certain Underwriters has been criticized. Allianz

Ins. Co. v. Guidant Corp., 884 N.E.2d 405, 418–19 (Ind. Ct. App. 2008) (citing John S. Vishneski III, The Illinois Supreme Court Gives Policyholders a Break from the Two-Front War, 27 N. Ill. U. L. Rev. 35, 59–60 (2006)). No. 24-1524 29

precedent itself suggests that once a court has entered a de- claratory judgment recognizing that the insured is bound to defend its insured, the insurer will be liable in contract for the fees and costs the insured has shouldered to date. Filing the declaratory judgment action will have insulated the insurer from estoppel—thus preserving the insurer’s contractual de- fenses—but not from (eventual) liability for the cost of the de- fense “it should have provided” to the insured while the duty to defend was being litigated in the declaratory action. 848 N.E.2d at 603. 10 Ultimately, Citizens’ concern is less with the logic of its prospective liability to Mullins than with the label “breach,” which it reads as being inconsistent with Those Certain Under- writers and exposing it to estoppel. How then to reconcile Cit- izens’ potential liability for having failed to defend Mullins with Citizens’ right to avoid estoppel? One way to do so might be to distinguish between a breach of the duty to de- fend so serious that it amounts to a repudiation of the insur- ance agreement—thus meriting estoppel—and a more quo- tidian breach that results only in liability for defense costs. Another might be to say that the insurer’s duty to defend is suspended upon filing an action for declaratory judgment and remains so until such time as the court finds that the

10 This is consistent with the principle that the duty to defend arises

at the time an insured gives its carrier notice of a claim potentially within the scope of the insurance policy, as opposed to the point at which a court later confirms that the insurer is obligated to defend its insured. See St. Paul Guardian Ins. Co. v. Walsh Constr. Co., 99 F.4th 1035, 1042 (7th Cir. 2024) (citing Lyons v. State Farm Fire & Cas. Co., 811 N.E.2d 718, 721 (Ill. App. Ct. 2004)); Lexington Ins. Co. v. Chi. Flameproof & Wood Specialties Corp., 950 F.3d 976, 980 (7th Cir. 2020); Cent. Ill. Light Co. v. Home Ins. Co., 821 N.E.2d 206, 216 (Ill. 2004). 30 No. 24-1524

insurer is obligated to defend the insured, at which point the insurer becomes retroactively liable for failing to defend its insured and will now owe the insured a defense going for- ward (if the underlying claim remains unresolved) and reim- bursement for its accrued defense costs as an “amount due,” but not as damages for a breach of contract. Either view would be based on the contract, and in this case, relief pre- sumably could be ordered pursuant to Mullins’ contractual claim. Alternatively, the obligation to compensate Mullins could be made part of the relief on its counterclaim for declar- atory relief. But we need not resolve the appropriate theoretical basis for ordering Citizens to reimburse Mullins in the event the court determines that Citizens was obliged to defend Mullins. Citizens has made clear both below and on appeal that it does not contest its obligation to reimburse Mullins if the court finds that Citizens owed it a defense. See Citizens Br. 44, 46; R. 89 at 6. There being no dispute on that score, we leave it to the parties and the district court on remand to arrive at an agreeable means of ensuring that Mullins is appropriately re- imbursed for its defense costs in the event that the court en- ters declaratory relief in favor of Mullins and against Citizens. To eliminate any doubt: estoppel is off the table, but reim- bursement to Mullins for its defense costs is not. For these reasons, we vacate the entry of summary judg- ment against Mullins on Count II of the counterclaim. In the event the district court ultimately resolves the notice issue in favor of Mullins, thus confirming that Citizens owes Mullins a duty of defense in the Galan suit under the 2015 policy, Cit- izens will be liable to Mullins for the costs and fees Mullins has incurred in defending itself in Galan. No. 24-1524 31

D. Timeliness of Mullins’ notice of the Galan litigation The insurance policies include a provision requiring the insured, in the event a claim is made or a suit is filed against it, to notify Citizens in writing “as soon as practicable.” R. 1-1 at 172, 408, 691. Not until nearly a year after it learned of the Galan suit did Mullins notify Citizens of the action and re- quest a defense. Citizens argued below that this was too late to constitute timely notice under the policy. The district court initially denied summary judgment on this question, finding that there were unresolved issues of material fact that precluded summary judgment. R. 61 at 25– 28. Subsequently, when the court, on reconsideration con- cluded that the Access or Disclosure and Statutory Violations Exclusions barred coverage for the BIPA violations alleged in the Galan suit, the court vacated its summary judgment ruling as to notice as moot. R. 98 at 28. Citizens now asks us to take up the notice question and hold that it is entitled to summary judgment on the issue. We leave it to the district court, however, to revisit the no- tice issue on remand. Given that the district court vacated its prior ruling on the issue, there is, at present, no ruling for us to review. Moreover, the court’s previous ruling on notice was one denying summary judgment, which is ordinarily not appealable under 28 U.S.C. § 1291. Dupree v. Younger, 598 U.S. 729, 733–34 (2023); Plumhoff v. Rickard, 572 U.S. 765, 771 (2014); Tousis v. Billiot, 84 F.4th 692, 697 (7th Cir. 2023). Citizens is, of course, free to renew its arguments as to the timeliness of Mullins’ notice in the district court on remand, but we leave it to the district court’s discretion how best to resolve the is- sue, including the option of reinstating its prior decision on this subject. 32 No. 24-1524

III. For the foregoing reasons, we have concluded that the Ac- cess or Disclosure Exclusion found in the 2016 and 2017 com- mercial liability policies that Citizens issued to Mullins bars coverage for injuries resulting from BIPA violations, whereas the Statutory Violations Exclusion, found in the 2015 policy as well as the 2016 and 2017 policies, does not. Citizens may therefore owe Mullins a duty of defense and indemnification under the 2015 policy, assuming that Mullins gave timely no- tice of the underlying claim to Citizens. The question of timely notice is to be resolved on remand. In the event the district court concludes that Mullins did provide Citizens with timely notice of the underlying claim and was thus owed a defense by Citizens in the Galan litigation, the judgment must incor- porate reimbursement to Mullins for the fees and costs it in- curred defending the Galan suit on its own while Citizens pur- sued this declaratory action. We therefore VACATE the judg- ment of the district court and REMAND for further proceed- ings consistent with this opinion. The parties shall bear their own costs of appeal.